Office of the Mayor 

City & County of San Francisco 



Via E-mail Only to SOTF@sfgov.org 

Honorable Members of the Sunshine Ordinance Task Force 
1 Dr. Carlton B. Goodlett Place, Room 244 
San Francisco, CA 94102 

May 21, 2019 

Re: File No. 19047, Anonymous (c/o 72902-46637773@requests.muckrock.com) v. Office of the 
Mayor, Mayor London Breed, and Flank Heckel 

Dear Honorable Members of the Sunshine Ordinance Task Force (“SOTF”): 

This letter serves as the response of the Office of the Mayor, Mayor London Breed and 
Ha nk Heckel (collectively “Respondents”) to the complaint designated File No. 19047, filed by 
an Anonymous requestor using an email address affiliated with MuckRock.com. See Complaint 
Noticed to Respondents on May 14, 2019. The complaint alleges a violation of S.F. 
Administrative Code Section 67.25 “by failing to respond to a request for public records in a 
timely and/or complete manner.” Respondents respectfully submit that the Office of the Mayor 
has responded to Anonymous’s request in a timely and appropriate manner and has not violated 
the Sunshine Ordinance. 

Background 

On the afternoon of May 8, 2019, the Anonymous Complainant submitted an Immediate 
Disclosure Request to the Office of the Mayor seeking “an electronic copy, in the original 
electronic format, with all calendar item headers, email addresses, metadata, timestamps, 
attachments, appendices, exhibits, and inline images, except those explicitly exempted by the 
Ordinance, of the Mayor’s calendar, with all items, from April 28 to May 4, 2019 (inclusive).” 
See Anonymous E-mail sent at 2:09 PM, 5/8/19. 

On the afternoon of May 9, 2019, the Office of the Mayor timely responded with a copy 
of the requested calendar entries containing the times of meetings and events, places of such 
meetings and events, names and information regarding attendees and a general statement of the 
issues discussed at a meeting or event, consistent with the “Prop G” calendar requirements. See 
Heckel E-mail sent at 4:13 PM, 5/9/19 and attached file; S. F. Admin Code § 67.29-5. The 
Office of the Mayor provided this information in a PDF format to avoid compromising the 
security and integrity of the record, citing to Cal. Gov. Code 6253.9 (f) as a basis. The calendar 
was provided in the Prop G format as required and no substantive information regarding the 
entries was withheld. Anonymous filed its complaint the next day seeking production of specific 
metadata and that the calendar be converted from Outlook into one or more formats other than 
PDF. 
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Argument 


Respondents have provided the requested calendar entries with all substantive 
information required by Prop G and have not withheld the date, time, location, subject matter or 
required attendee infonnation for any item. This information was provided in a PDF format 
which is nearly universally accessible, which safeguards against tampering with the record in its 
native format and which protects against a security breach of the system on which the record was 
created. Anonymous’ complaint is focused on information which either a) does not exist or b) 
comprises non-substantive metadata such as security validation infonnation, the disclosure of 
which could jeopardize the security and integrity of both the system on which the file was 
created and the overall City system in which such records may be maintained. 

Anonymous complains that the Office of the Mayor has inappropriately withheld certain 
types of information in its response including 1) email addresses, 2) “actual names of attendees 
instead of group descriptions”, 3) “the acceptance/rejection of individual attendees to the invite”, 
4) conference call numbers, and 5) “headers, metadata, timestamps, attachments, exhibits, and 
inline images”. See Complaint Summary pp. 000009-000011. 

Available Substantive Information Has Been Provided 

As an initial matter. Items 1 and 3 above have not been withheld because they do not 
exist. The Prop G calendar maintained by the Office of the Mayor does not use the invite feature 
of the Outlook calendar to invite and record attendees. Accordingly there are no associated 
emails and no information concerning acceptance/rejection of individual attendees to provide. 
Regarding Item 3 above, the Office of the Mayor has provided the names and affiliations of 
individual attendees for meetings or events with ten or fewer attendees as required by the Prop G 
ordinance. (See S. F. Admin Code § 67.29-5 (b): “For meetings or events with ten or fewer 
attendees, the calendar shall also identify the individual(s) present and organization(s) 
represented at the meeting or event if known by the official”). The only events for which “group 
descriptions” were provided were events with greater than ten attendees. In addition, the date, 
time, location and subject matter information were provided in compliance with Prop G. 

Regarding Item 4, no conference call numbers were recorded on the calendar because 
such information is not required under Prop G and provision of such numbers could jeopardize 
official, security-related, confidential, and/or privileged information which may be exchanged 
over the phone. 

Metadata 

Regarding the types of information included within Item 5 above, some of this information 
does not exist. For example, there are no attachments, exhibits or inline images (such as 
embedded images or hyperlinks) created and maintained for the calendar entries so there is no 
information to provide. 

The remaining types of information identified - headers, metadata, and timestamps - can 
be broadly defined under the category of “metadata” and associated data. The term “metadata” 



refers to electronic data embedded in a document about the document itself. The amount of 
metadata available for a particular file can vary greatly depending on the software used to create 
the file and the system on which it is maintained. The Office of the Mayor does not routinely 
maintain specific types of metadata or index them as records. Further, the Office of the Mayor 
and City departments generally do not search for and provide metadata in response to records 
requests. The current administration has not in the past provided metadata in response to a 
similar request. Searching through metadata is a highly technical and specialized effort, and the 
Office of the Mayor does not include staff with experience and expertise in using, maintaining or 
searching metadata. 

Producing documents with metadata can subject the City to security risks and can lead to 
the inadvertent disclosure of privileged information. For example, certain types of metadata 
associated with Outlook files can include “headers” as requested by Anonymous that are lines of 
code information used for validation purposes to screen files from outside sources for viruses, 
malware and other cyber risks. Access to this data could provide information regarding the 
system used by the City to protect against phishing, hacking and other cyber-attacks. (For an 
illustration of the risks posed by such security breaches, see the attached New York Times article 
regarding the hacking and crippling of the City of Atlanta’s computer systems). Accordingly, 
the Public Records Act expressly does not require an agency to produce records in their 
electronic formats if it would jeopardize or compromise the security or integrity of the original 
records, or of any software in which they are maintained. See Cal. Govt. Code § 6253.9(f). The 
Office of the Mayor cited this provision in its response to Anonymous. 

To safeguard the security of the City’s computer system, it is necessary to withhold 
metadata that describes unique identifiers for individual computer terminals and computer 
servers and associated security certificates and similar information. This information is highly 
sensitive, as disclosing it could allow a hacker to penetrate the system or enable a hacker to 
“spoof’ emails and insert themselves into confidential and/or privileged discussions or send 
unauthorized emails on behalf of city officials. Thus, there is a substantial need for 
confidentiality that outweighs any interest the requester may have in accessing this information. 
See Cal. Evid. Code § 1040. 

Metadata may include a wide variety of information that the Office of the Mayor has a 
right, and in some cases a legal duty, to withhold from public view. For example, metadata may 
be used to reveal the editing history of a privileged document or communications to or from or 
work product by members of the City Attorney’s Office which is exempt from disclosure under 
the attorney-client privilege and work product privilege. Cal. Gov’t Code § 6276.04; Cal. Evid. 
Code § 954; Cal. Code Civ. Proc. § 2018.030. Disclosing metadata could also in theory reveal 
the identity of a confidential whistleblower or protected health infonnation. Cal. Evid. Code § 
1041; Charter §§ C3.699-13(a), FI.107(c); C&GC Code §§ 4.120, 4.123; 45. C.F.R. §§ 164.500 
et seq. Finally, there is the overarching risk that disclosure may reveal sensitive infonnation 
about the operation of the City’s computer and communications system that a third party could 
use to hack into the system, or to otherwise undennine the integrity and security of the system. 



Format of Records 


In connection with their request for metadata, Anonymous has sought production of the 
requested records in one or more specific fonnats other than PDF. For example. Anonymous 
requests that the calendar be exported in the “.ics, iCalendar or vCard” fonnat. None of these are 
the native fonnat in which the calendar is maintained. As a practical matter, the calendar 
excerpts cannot be routinely provided in these formats without including associated metadata 
that should be withheld for the reasons discussed above. 

Regarding the iCalendar format, conversion of the calendar to this format would simply 
create a “native” file of the whole calendar, as opposed to individual entries. The normal view of 
this format to the user also does not provide additional substantive information beyond what 
would be viewed in the standard Outlook view. Associated metadata would still have to be 
extracted from the server or the file by someone with the requisite technical expertise and should 
be withheld in any case, as noted above. 

Regarding an .ics format, this would require exporting the file to a format that is not 
typically used or maintained. This also carries the same concerns regarding the technical steps of 
harvesting metadata and the risks associated with disclosing it. 

Regarding Vcard, we have not seen an available method for saving or converting the 
calendar to this fonnat that is readily accessible to the users of the system in the Office of the 
Mayor. 


Anonymous’ position regarding these formats is also not supported by the Public Records 
Act and the Sunshine Ordinance. Contrary to Anonymous’s argument, Cal. Gov. Code 6253.9 
(a), which the Office of the Mayor cited in providing the calendar entries as a PDF, does not 
dictate that we provide the requested files in one of the specific fonnats requested. Cal. Gov. 
Code 6253.9 (a)(1) states that the “[t]he agency shall make the infonnation available in any 
electronic format in which it holds the information.” The Office of the Mayor does not “hold” 
the Prop G calendar in an iCalendar, .ics or Vcard format because, as noted above, the calendar 
is not maintained in any of these formats. Providing the calendar in such a format or indeed any 
format containing the headers and other metadata requested would require a conversion or export 
or some other transfonnative step. Cal. Gov. Code 6253.9 (a)(2) separately states the “agency 
shall provide a copy of an electronic record in the format requested if the requested format is one 
that has been used by the agency to create copies for its own use or for provision to other 
agencies”. The Office of the Mayor does not use the requested formats to create copies of the 
Prop G calendar for its own use or to provide it to other agencies. 

Similarly, 6253.9 (f) provides support for declining to produce a record in a particular 
format if disclosure in such format jeopardizes the security or integrity of the record or the 
system on which it is maintained: “Nothing in this section shall be construed to require the public 
agency to release an electronic record in the electronic form in which it is held by the agency if 
its release would jeopardize or compromise the security or integrity of the original record or of 
any proprietary software in which it is maintained.” 



Further, the Sunshine Ordinance provides that “[t]o the extent that it is technologically 
and economically feasible, departments that use computer systems to collect and store public 
records shall program and design these systems to ensure convenient, efficient, and economical 
public access to records.” S.F. Admin Code 67.21-l(a). The Office of the Mayor has 
maintained the calendar entries sought and provided them in a PDF format that is convenient, 
efficient and economical to view. The formats sought by requestor are less universally 
accessible and carry risks with associated metadata. Further, nothing in the sections of the 
Sunshine Ordinance limiting or abrogating disclosure exceptions in the California Public 
Records Act overturns the specific protections of Cal Govt. Code 6253.9 (f) regarding data 
security. See S.F. Admin Code 67.24 (a) - (i). 

Appropriateness of Response 

Anonymous makes a secondary argument that the Office of the Mayor violated the 
Sunshine Ordinance by withholding infonnation without citing a basis for doing so. As noted 
above, no substantive information was redacted or otherwise withheld from the Prop G calendar 
entries. Furthermore, regarding metadata, the Office of the Mayor noted that it was providing 
the infonnation in PDF, as opposed to a native fonnat, and specifically cited Cal Gov. Code 
6253.9 (f) and its protection for the security and integrity of the record and the underlying 
system. Accordingly Respondents submit that Anonymous was provided with specific notice 
regarding the reasons for the format provided. 

For all of the above reasons, the Office of the Mayor respectfully submits that it has 
provided a timely and appropriate response to Anonymous’s request and there has been no 
violation of the Sunshine Ordinance. The Office of the Mayor is available to work with 
Anonymous and SOTF to address further questions and concerns regarding the request. 

Sincerely, 

/s/ Hank Heckel 

Hank Heckel 

Compliance Officer 

Office of the Mayor 

City and County of San Francisco 



